Add dscp field to FirewallRule model - #919
Merged
jaredhendrickson13 merged 1 commit intoJul 23, 2026
Merged
Conversation
The pfSense webConfigurator supports matching firewall rules on a DSCP value (config field 'dscp', rendered as 'tos <value>' in rules.debug), but the FirewallRule model did not define the field. API clients that submitted 'dscp' had the value silently discarded: the rule was created without the DSCP match, which for policy-routing rules meant matching far more traffic than intended. Adds the field with pfSense's canonical choice list (guiconfig.inc $firewall_rules_dscp_types) and a test asserting the value reaches the generated pfctl rule.
jaredhendrickson13
enabled auto-merge (squash)
July 23, 2026 15:44
jaredhendrickson13
disabled auto-merge
July 23, 2026 15:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #918.
What
Adds the
dscpfield to theFirewallRulemodel. The pfSense webConfigurator supports matching rules on a DSCP value (config fielddscp, rendered astos <value>inrules.debug), but the model didn't define it, so API clients submittingdscphad the value silently discarded — for policy-routing rules that means matching (and re-routing) far more traffic than intended.How
StringFieldwith pfSense's canonical choice list ($firewall_rules_dscp_typesfromguiconfig.inc),allow_emptyfor the unset case, placed with the other match-criteria fields.test_dscpinAPIModelsFirewallRuleTestCase, following the existingtest_statetypepattern: creates a rule withdscp => af11, asserts the generated ruleset containstos af11 ridentifier {tracker}, deletes the rule.Testing
Beyond the included test case, the identical field definition was applied to a live pfSense 2.7.2 install (v2.4.0 package) and verified end-to-end:
POST /api/v2/firewall/rulewith"dscp":"af11"→ 200 withdscpechoed in the responseGETfirewall/apply,pfctl -srshows the rule withtos 0x28(AF11) andrules.debugshowstos af11dscpare unaffected (field defaults to empty)